Privacy Policy
This document is published in English. A French version is being prepared; if you need one before it is published, write to admin.jobliy@gmail.com.
Effective date: 15 August 2026 Version: 1.0
Jobliy Technologies Inc. ("Jobliy", "we", "us") operates the Jobliy recruiting marketplace as a website and as iOS and Android applications. This policy explains what personal information we collect, why, who else touches it, how long we keep it, and what you can require of us. It applies to everything we operate, on every device.
Jobliy is offered in Canada only. We do not offer the service to users outside Canada, and this policy is written to Canadian law.
1. Who is responsible for your information
Jobliy Technologies Inc.
840 Queens Plate Drive, Toronto, Ontario M9W 0E7, Canada
admin.jobliy@gmail.com
Privacy Officer. Accountability for the protection of personal information at Jobliy rests with
the person exercising the highest authority in the company, who holds the role of Privacy Officer.
You can reach that person at admin.jobliy@gmail.com, and we answer access and correction requests
within 30 days, as PIPEDA and Quebec's Law 25 both require.
2. The laws this policy is written to
| Law | What it governs here |
|---|---|
| PIPEDA (federal) | consent, access, correction, deletion, accountability |
| Quebec Law 25 | the Privacy Officer, automated decisions, portability, breach reporting, consent for each purpose |
| Quebec Charter of the French language | French-language versions of what we show Quebec users |
| Ontario ESA, s. 8.4–8.6 | job posting disclosures, including AI use, and a three-year retention duty on employers |
| CASL | commercial email: consent, sender identification, unsubscribe |
3. What we collect
3.1 What you give us
Account. Your email address, your password (stored only as a hash by our authentication provider — we never see it), your preferred language, and whether you signed up to look for work or to hire.
Candidate profile. Your name, headline, location, years of experience, salary expectations, availability, work-authorization status, the categories and skills you select, and any photo you upload.
Career history. The employers, titles, dates and descriptions you enter, and your education.
Documents. Résumés and other files you upload. They are held in private storage and are reachable only through short-lived signed links — never a public address — by you and by employers you have applied to or accepted contact from.
Applications. Which jobs you applied to, your answers to any screening questions the employer set, and the status of each application over time.
Messages and interviews. Your conversations with employers, interview times offered and chosen, and any offer you receive.
If you use Jobliy to hire. Your company's details, your team members, your job postings and the Ontario and Quebec compliance answers attached to them, and the notes and scorecards your team writes about candidates.
3.2 What is generated as you use Jobliy
- The jobs you passed on or kept, and the searches and alerts you saved. - When an employer opens your profile, and when you open a company's. - Matches, and the explanation of why a job was ranked where it was for you. - What we sent you, when, and whether it was accepted for delivery. - Which AI feature you invoked and what it cost us, used to enforce spending limits. - A security log of significant actions, kept for trust and safety. This is the one record about you that we do not hand back on request; section 7 explains why.
3.3 Information about you that came from someone else
An employer may add a candidate they found elsewhere. If that happens, a record about you can exist before you have an account.
That record is inert. It cannot be attached to you as a user unless you claim it, and claiming it requires your consent — that gate is enforced in the database, not by policy alone. Until you claim it, no employer action on it reaches you.
You may ask us at any time whether such a record about you exists, and require its deletion. Write
to admin.jobliy@gmail.com.
3.4 What we do not collect
We do not collect government identifiers, financial account numbers, health information, or sensitive categories such as race, religion, sexual orientation or union membership. They are not fields in Jobliy and not questions we ask.
Employers write their own screening questions in free text, so we cannot guarantee that no employer ever asks something they should not. Section 11 explains what we do about it.
4. Why we use it
| Purpose | In practice |
|---|---|
| Running the service | matching candidates to jobs, delivering applications, hosting messages |
| Ranking and relevance | ordering what you are shown, and explaining why |
| AI features | résumé parsing, job coaching, application pitches — each one optional and separately consented to |
| Transactional email and notifications | application updates, interview invitations, the alerts you asked for |
| Safety and fraud prevention | the security log, reports, verification decisions |
| Legal compliance | Ontario posting records, Quebec language records, and financial records |
| Keeping Jobliy working | error monitoring and aggregate product measurement |
We do not sell personal information, and we do not share it with advertisers.
5. Who else touches your information
Your database records, your account and your files are stored with Supabase in the `ca-central-1` region — Canada. That location is fixed in the architecture of the product, not a setting.
Some processing necessarily happens outside Canada:
| Who | What they receive | Where | In use today |
|---|---|---|---|
| Supabase | the database, authentication, uploaded files | Canada | yes |
| Vercel | website hosting and delivery; request metadata | United States and global edge | yes |
| Anthropic | the text you submit to an AI feature — résumé text, job descriptions, profile text — and only when you invoke one | United States | yes |
| Resend | recipient address and message content, for transactional email | United States | yes |
| Stripe | payment details, handled by Stripe; card numbers never reach Jobliy | United States | no — no paid plans are sold today |
| Apple, Google | in-app purchase receipts, for validation | United States | no |
| Sentry | application error reports, which can incidentally contain identifiers | United States | no — the integration exists in the code but is not enabled in production |
Transfers outside Canada. Sending personal information outside Canada is permitted under PIPEDA where comparable protection and transparency exist. The transfer to Anthropic for AI features is the only one that carries content you wrote, and it happens only when you invoke an AI feature, and only after you have separately consented to it (section 6).
6. Consent
We ask for consent purpose by purpose, and we keep a record of each answer against the version of the policy it was given under.
| Purpose | How it is asked |
|---|---|
| These Terms and this Privacy Policy | accepted when you create an account |
| AI processing | separate, off by default, asked the first time you invoke an AI feature. Until you agree, our AI functions refuse the request outright — the check is in the database, not in the app |
| Marketing email | separate, off by default. We do not send it without your express agreement |
| Aggregate product measurement | separate |
You may withdraw any consent at any time in your notification and privacy settings, or by writing to us. Withdrawing consent for AI processing turns the AI features off; the rest of Jobliy continues to work.
7. How long we keep it, and what you can require
Your account. Until you delete it. Deletion is self-service and it works: it erases your records, removes your files from our storage, anonymises the security log rather than deleting it, and then deletes your authentication account. It does not reach into records that belong to an employer, because those are not ours to delete.
Automatic housekeeping already running:
| Record | Kept |
|---|---|
| Queued email that could not be delivered | 72 hours |
| Records of sent or cancelled email | 30 days |
| The download link for a copy of your data | 7 days |
| An application before it counts as unanswered | 30 days of employer silence |
Where the law requires an employer to keep something. Ontario's *Employment Standards Act* requires an employer to retain a job posting and the application forms for three years after the posting is taken down. Where that duty applies, deleting your Jobliy account does not extinguish it: we honour your deletion, and any record the statute requires is retained by the employer to whom the duty belongs, unlinked from your account and not searchable as a candidate profile.
Your rights. At any time you may:
- get a copy of everything we hold about you — self-service, and it covers every record carrying your data; - correct anything on your profile; - delete your account; - withdraw a consent; - unsubscribe from any email we send.
You may also complain to the Office of the Privacy Commissioner of Canada, or, in Quebec, to the Commission d'accès à l'information.
A small number of records are not included in the copy you receive, each for a stated reason: the security log, because returning it would expose the moderation trail about you; an employer's private notes and scorecards, which are their assessment and not your data to take; and derived technical values that carry no readable content. The facts those are derived from are all included.
8. Automated processing and AI
Quebec's Law 25 requires us to tell you when a decision about you is made exclusively by automated means, and to let you make submissions to a person. Ontario's *Employment Standards Act* requires job postings to disclose whether AI is used to screen or select applicants.
What is automated here: the order in which jobs are shown to you, and the explanation of why a job matched. The ranking is deterministic and the explanation you are shown is the actual reason for the ordering, not a summary of one.
What is not automated: every hiring decision. Whether to advance, interview, make an offer or reject you is made by a person at the employer. Jobliy does not screen anyone out.
Ranking applies to every posting on Jobliy. An employer answering the Ontario disclosure question must answer it on that basis.
9. Children and young people
You must be at least 16 years old to use Jobliy. We do not knowingly collect information from anyone younger, and we will delete an account we learn belongs to someone younger.
10. Security
Access control is enforced in the database itself, on every table, and not only in application code. Operations requiring privileged keys run on our servers and never in a browser or an app. Passwords are hashed by our authentication provider and are never visible to us. Résumés are held in private storage reachable only through short-lived signed links.
No system is perfectly secure. If a breach creates a risk of serious injury we will notify the affected users and the relevant regulator, as PIPEDA and Law 25 both require, and we keep the register of incidents Law 25 mandates.
11. Complaints about another user
If an employer asks you something they should not, or if any user misuses your information, report
it from within the product or write to admin.jobliy@gmail.com. We remove postings and screening
questions that solicit a prohibited ground, and we can suspend the account behind them.
12. Changes to this policy
When this policy changes materially we will tell you and record your acknowledgement against the new version, so that a consent you gave always points at the exact text you agreed to.
13. Contact
Jobliy Technologies Inc.
840 Queens Plate Drive, Toronto, Ontario M9W 0E7, Canada
admin.jobliy@gmail.com